DL-387

The gateway image gets no :latest and no :vX.Y.Z retag. Its digest reaches DefaultGatewayImage only through a reviewed manual pin PR, the same as DefaultCollectorImage, and the publish job’s step summary supplies the digest

Status: Active (Matt, 2026-10-03)